The most important column wasn't on the list

The setup

The console surfaced endpoint detection data directly, which meant it could show far more per alert than an analyst could read at a glance. Engineering had 27 fields available and one question: which belong in the default view, and which stay one click away.

Framed that way it reads as a preference call. In practice it was a question about what analysts reach for in the middle of an investigation, and a preference stated in a planning meeting is a poor guide to that. So the study was built to answer it with behaviour, not opinion.

How the research worked

Three sources ran in parallel so no single one had to carry the answer. A card sort put all 27 fields in front of each analyst to rank. Workflow interviews traced the order analysts actually move through during an investigation, with a first-mention pass to catch the fields that came up unprompted. And 30 days of product telemetry showed what analysts clicked into on the live console. Interviews say what people believe they need; telemetry shows what they do. Where the two agree, a default is safe to set.

The panel was five SOC analysts across four organizations: an internal SOC, a financial-services team, a retail team, and one more enterprise SOC. Five is light for interviews, so the telemetry was not a bonus. It was the backstop that let five voices stand on 1,880 real events.

Scale was handled with tooling. Transcript coding and the telemetry cross-reference were run through an AI-assisted synthesis pass and then validated by hand, which compressed the coding phase enough to land the recommendations inside the sprint that needed them rather than after it.

Finding one

Consensus cut 27 fields to 8

Analysts did not want all 27, and they did not want a minimal five either. The card sort and the scan-order interviews converged on the same eight fields, and those eight lined up with the triage sequence analysts described out loud: severity to decide what matters, a timestamp for context, hostname to place it, user for attribution, then process name, process path, command line, and activity to see what actually ran.

I go host name, then process path, process name, command line, and then into the parent.a financial-services analyst, describing a real investigation

The eight fields were not the interesting part on their own. The order was. Arranging the defaults to match the scan path meant an analyst could triage top to bottom without reaching for a menu, and that ordering is what the recommendation encoded.

Finding three

The same data demoted what no one touched

The evidence that promoted parent process pushed other fields down. Six of the 27 - process integrity, artifact, hash ID, version, rank, and score - drew no recognition in interviews and near-zero telemetry. Analysts either could not say what they held or had never used them. One pulled up an integrity field live and found every value set to zero.

I can see the integrity level, but the values are all zero. I've never used it in a case.an internal SOC analyst

Two smaller decisions fell out of the same data. Analysts used SHA-256 for external reputation lookups and treated MD5 as legacy clutter, so the default kept SHA-256 and dropped MD5. And for the incident timeline, all five preferred a filterable list over a node-graph, and four of five preferred a horizontal layout, because a graph forced one node open at a time when the job is comparing several at once.